Data Protection, Privacy and Security Alert

France's newly published Law for a Digital Republic includes key provisions that aim to foster more consumer and user trust in the digital ecosystem by requiring enhanced transparency and fairness obligations for online platforms and heightened confidentiality of private electronic correspondence. These provisions will be fully effective upon the adoption of implementing decrees, which are expected within the coming months.

The Law for a Digital Republic introduces in the French Consumer Code a new definition of online platform operators: any individual or legal entity offering, on a professional basis, whether for free or for consideration, an online public communication service consisting of either (i) ranking or referencing content, goods or services offered or uploaded by third parties, by using computerized algorithms (e.g., online price comparison tools); or (ii) bringing together several parties (intermediation) for the sale of a good, the provision of a service or the exchange or sharing of content, a good or a service (i.e., marketplaces).

Under the Law, online platform operators are required to provide fair, clear and transparent information regarding (i) the general terms of use of any intermediation service; (ii) the referencing, ranking and dereferencing criteria for content, goods and services offered or uploaded; (iii) the existence of any contractual relationship, capitalistic relation or direct remuneration for the operator's benefit that influences the classification or referencing of the content, goods or services offered or uploaded; (iv) any person acting as an advertiser; and (v) the rights and obligations of each party under civil and tax laws when consumers are put in contact with professionals or non-professionals. Implementing decrees are expected by March 2017 to specify these obligations.

In addition, online platform operators whose activity generates connections above a certain threshold (to be defined by implementing decree by March 2017) must establish and make available to consumers good practices guidelines aimed at strengthening the obligations of clarity, transparency and fairness mentioned above.

Marketplaces will be required to provide professionals with a space that allows them to comply with their own information obligations vis-à-vis consumers. The implementing decree specifying requirements for this space is expected in March 2017.

The regulator is empowered to conduct audits of platform operators' business practices. The regulator will publish the results of these evaluations and a list of platform operators that do not comply with the information obligations.

Finally, websites that collect, moderate or disseminate consumer reviews or opinions will be required to provide a host of new information in a fair, clear and transparent manner regarding the conditions for publishing and processing these reviews or opinions. Here again, an implementing decree will specify the requirements for providing this information.

New consent requirement to ensure confidentiality of electronic correspondence

The Law introduces into the Postal and Electronic Communications Code a definition of online public communication service providers as any person making available content, services or applications that constitutes online communication to the public.

Telecom operators and online public communication service providers are required to maintain the confidentiality of user correspondence, including the content of the message, the correspondents' identity and, where applicable, the subject line and attachments. The automatic analysis of such correspondence for advertising, statistical or service improvement purposes is prohibited, except with the user's express, specific and time-limited consent. The period of validity of such consent (which cannot be longer than one year) will be specified by an implementing decree expected by the end of 2016.

However, electronic correspondence can still be automatically analyzed without users' express, specific and time-limited consent whenever the analysis is for purposes of displaying, sorting or dispatching messages, or detecting unsolicited content or computer malware.

Telecom operators and online public communication service providers will be required to inform their employees of the new confidentiality obligations.

Related topics

DLA Piper is a global law firm with lawyers located in more than 40 countries throughout the Americas, Europe, the Middle East, Africa and Asia Pacific, positioning us to help clients with their legal needs around the world.

DLA Piper is a global law firm with lawyers located in more than 40 countries throughout the Americas, Europe, the Middle East, Africa and Asia Pacific, positioning us to help clients with their legal needs around the world.